"Before starting any forensic analysis, it is important to create a copy of the storage medium you will be investigating, either as a 1:1 copy or as an image or a collection of images. You can copy the medium as a raw image (with dd) or use a format such as Expert Witness Format (EWF)."